Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

sample.exe

windows7_x64

3

sample.exe

windows10-2004_x64

10

Resubmissions

01/03/2022, 08:14

220301-j4ypeaafcr 10

01/03/2022, 07:35

220301-jevapaghd6 10

Analysis

  • max time kernel
    4294180s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    01/03/2022, 07:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sample.exe

  • Size

    141KB

  • MD5

    1c2af6c5e1b8b87189b5da7bd3cefe30

  • SHA1

    6881acb4f1401f0db02bbebe82e2381a0b7c447d

  • SHA256

    cf0705a3e4f3690e28184eb019a4940e7291ce5b3d52747ff80b72e90922a89b

  • SHA512

    1f391111cbeb12f892c272076111a8317b98c9eda4bbf12eefb7a47bcc1a327b43310739a301718b700dc2ce28339b00533f2c9eda1f06ffff21f30d69ce6362

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sample.exe
    "C:\Users\Admin\AppData\Local\Temp\sample.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1476 -s 612
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/764-56-0x000007FEFC401000-0x000007FEFC403000-memory.dmp

    Filesize

    8KB

    Download

  • memory/764-59-0x00000000005B0000-0x00000000005B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1476-54-0x00000000000E0000-0x000000000010A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/1476-55-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1476-58-0x0000000000400000-0x0000000000401000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1476-57-0x000000001B050000-0x000000001B052000-memory.dmp

    Filesize

    8KB

    Download